{"id":"DEBIAN-CVE-2026-112112","details":"An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.","modified":"2026-10-19T10:00:07.451500430Z","published":"2026-10-19T09:47:38.001679851Z","upstream":["CVE-2026-112112"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-112112"}],"affected":[{"package":{"name":"bird2","ecosystem":"Debian:12","purl":"pkg:deb/debian/bird2?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.12-7","2.14-1","2.15-1","2.15.1-1","2.15.1-1.1","2.16-1","2.16.1-1","2.17-1","2.17.1-1","2.17.2-1","2.17.3-1","2.17.3-2","2.18-1","2.18.1-1","2.19.0-1","2.19.1-1","2.19.2-1","2.20.0-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-112112.json"}},{"package":{"name":"bird2","ecosystem":"Debian:13","purl":"pkg:deb/debian/bird2?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.17.1-1","2.17.1-1+deb13u1","2.17.1-1+deb13u2","2.17.2-1","2.17.3-1","2.17.3-2","2.17.5-0+deb13u1","2.18-1","2.18.1-1","2.19.0-1","2.19.1-1","2.19.2-1","2.20.0-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-112112.json"}},{"package":{"name":"bird2","ecosystem":"Debian:14","purl":"pkg:deb/debian/bird2?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.17.1-1","2.17.2-1","2.17.3-1","2.17.3-2","2.18-1","2.18.1-1","2.19.0-1","2.19.1-1","2.19.2-1","2.20.0-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-112112.json"}},{"package":{"name":"bird3","ecosystem":"Debian:13","purl":"pkg:deb/debian/bird3?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.0-1","3.1.4-1","3.1.5-1","3.1.5-2","3.1.7-0+deb13u1","3.2.0-1","3.2.1-1","3.3.0-1","3.3.0-1~bpo13+1","3.3.1-1","3.3.2-1","3.3.2-1~bpo13+1","3.4.0-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-112112.json"}},{"package":{"name":"bird3","ecosystem":"Debian:14","purl":"pkg:deb/debian/bird3?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.0-1","3.1.4-1","3.1.5-1","3.1.5-2","3.2.0-1","3.2.1-1","3.3.0-1","3.3.0-1~bpo13+1","3.3.1-1","3.3.2-1","3.3.2-1~bpo13+1","3.4.0-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-112112.json"}}],"schema_version":"1.9.0"}